I'm WP newbie and my website is hacked (Pharma Hack)

I would first get BulletProof Security (plugin) running to lock the doors, then Wordfence Security can scan all WordPress files at your site and tell you which ones do not match their originals. After that, I have heard there are scanners that can locate other intrusions, but I have no experience with any of those since I have never had to use one.

10 months of work being hacked is a hard-won lesson, but now you know.

You need to start working your way through these resources:
https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

Additional Resources:
Hardening WordPress
https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html
https://blog.sucuri.net/2010/07/understanding-and-cleaning-the-pharma-hack-on-wordpress.html